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ABSTRACT 

/The  AFTI/F-16  Advanced  Development  Programp  a joint  USAF/USN/US  Army/NASA  effort  with  General 
Dynamics  (CD),  has^modified  an  F-16A  to  be  a "testbed  for  evaluating  new  flight  control  related  technologies. 
The  program  has  ‘presentiyi'completed  its  first  phase  of  flight  testing. -86,  NASA  Dryden  Flight  Research 
Facility,  Edwards  AFB,  CA.  ;Some  of  the  ‘unique) technologies~being  developed  :on  this  program>are:  a 

triplex  digital  fly-by-wire  flight  control  system  which  operates  asynchronously,  an  analog  independent 
backup  unit  (IBU),  eight  separate  digital  task-tailored  control  laws,  and  six  decoupled  (six  degrees-of-^-.  . 
freedom}  controller  options.  Included  among  these  task-tailored  modes  are  normal  operation  modes,  air- 
to-air  combat  modest"  and  air-to-surface  combat  modes.  One  unique  aspect  of  this  program  was  the  heavy 
involvement  of  the  AFTI/F-16  Joint  Test  Force  throughout  the  entire  system  development  (pre-flight  test) 
phascoif  this  program ,*r  This  forced  early  design  consideration  to  be  given  to  pilot-vehicle  interface 
issues.  Through] tfUe  use-ofTltherGi§!frimulator,  the  test  pilot  became  an  integral  part  of  the  flight  control 
law  design.  The' AFTI/F-16  can  be  landed  in  possibly  n.ne  different  sets  of  control  laws  including  its 
normal  digital  mode,  seven  different  sensor  reconfiguration  digital  modes,  and  the  analog  IBU.  Much 
concern  surfaced  prior  to  first  flight  as  to  how  landable  these  different  modes  were;  this  resulted  in  all 
the  landing  modes  being  extensively  tested  on  the  GD  Simulator,  the  Flight  Dynamics  Lab  LAMARS,  and  the 
NT-33  Inflight  Simulator.  £-io  date^Jwo  of  these  modes,  the  normal  mode  and  the  IBU,  have  been  flight 
tested  on  the  AFTI/F-16  itself;  andfthe  flight  test  results  were  different  from  any  of  the  simulators' 
predicted  results.  This  has  raised  several  issues  on  the  use  of  simulators  to  accurately  represent  today’s 
highly  augmented  fighter  aircraft. ^This  paper  will  discuss  several  flight  test  issues,  how  they  were 
resolved,  and  their  effect  especially  on  the  aircraft  handling  qualities.  Specific  topics  which  will  be 
discussed  are:  the  IBU,  the  effect  of  the  asynchronous  computer  operation  and  system  redundancy  manage- 

ment has  on  the  flight  control  laws  and  flight  testing,  and  some  handling  qualities  problems  with 
combination  coupled/decoupled  control  laws. 

INTRODUCTION 

The  AFTI/F-16  Advanced  Development  Program  is  primarily  oriented  to  the  development,  integration,  and 
evaluation  of  new  flight  control  technologies.  The  testbed  used  in  this  program  is  an  FSD  F-16A  (Figure  1) . 
In  this  aircraft  the  quad  redundant  analog  flight  control  computer  system  was  replaced  with  a triply 
redundant  digital  flight  control  computer  system  using  three  BDX-930  digital  processors  and  a triply 
redundant  analog  independent  backup  unit.  New  control  surfaces  were  attached  to  the  aircraft  and  usage 
of  existing  control  surfaces  was  changed  to  provide  more  capability  and  flexibility  in  the  flight  control 
law  design  and  to  allow  limited  six  degree-of-freedom  decoupled  motion  capability.  The  surfaces  added  to 

the  aircraft  were  two  vertical  chin  canards,  which  were  attached  below  the  engine  inlet,  to  provide 

enhanced  directional  force  and  moment  control  and  to  provide  drag  modulation  capability.  The  surface  whose 
usage  was  changed  was  trailing  edge  flaps.  In  the  F-16  these  two  surfaces  are  only  used  for  roll  control 

and  as  normal  flaps  in  landing.  In  the  AFTI/F-16,  they  are  used  additionally  in  maneuvering  flight  to 

enhance  the  onset  and  control  of  normal  acceleration  and  to  provide  longitudinal  decoupled  flight  control. 
This  pacer  directs  its  attention  .o  three  major  design  issues  which  had  an  impact  on  the  first  phase  of  the 
program.  These  issues  which  will  be  discussed  in  the  next  three  sections  of  this  paper  are  a direcc  result 
of  these  system  modifications.  This  paper  addresses  each  issue,  the  tradeoffs,  the  results,  and  its  impact 
in  flight  testing. 


Figure  1 The  AFTl/F-16 
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ISSUE:  THE  INDEPENDENT  BACKUP  UNIT  (IBU) 

The  AFTI/F-16  digital  flight  control  system  was  designed  to  meet  several  basic  requirements: 

1.  Architecture:  full  authority,  triplex  digital,  fly-by-wire  system. 

2.  Reliability:  DFC_  failure  rjte  resulting  in  loss  of  control  of  the  aircraft  will  be  less  than  1 

failure  in  every  10^  flight  hours. 

3.  Fail-Operation:  the  DFCS  shall  be  fully  operational  (Operational  State  I as  defined  in 

MIL-F-94 90D)  after  any  first  failure.  After  any  second  like  failure,  the  control  system  will  provide  at 
least  safe  flight  (Operational  State  III,  MIL-F-9490D)  with  a probab<l  y of  0.95  being  fully  operational. 

These  requirements  were  to  be  met  without  reliance  on  an  IBU.  The  primary  reason  for  an  IBU  was  to  have  a 
backup  system  which  was  Independent  of  all  the  digital  flight  control  software.  This  IBU  was  to  be  designed 
to  allow  for  its  removal  after  sufficient  confidence  was  developed  in  the  primary  digital  system.  Also 
required  was  that  the  primary  system  and  the  IBU  be  designed  so  that  the  performance  of  the  primary  digital 
flight  control  systemwould  not  be  affected  by  the  removal  of  the  IBU.  The  IBU  alone  would  provide  at  least 
Level  3 flying  qualities,  as  defined  in  MIL-F-8785B,  throughout  the  flight  envelope  and  at  least  Level  2 
flying  qualities  in  the  landing  phase. 

Several  pro/cons  exist  for  having  an  analog  independent  backup  for  a digital  flight  control  system. 

The  basic  reason  for  an  IBU  is  to  protect  against  unknown  - unknowns  in  the  digital  software,  especially 
generic  software  design  errors.  Due  to  an  IBU  being  dissimilar  redundancy,  it  also  provides  some 
protection  against  flight  control  EMI  upsets.  The  presence  of  an  IBU  gives  a definite  increase  in  pilot 
and  user  - command  confidence  in  flight  testing  a new  digital  flight  control  system.  An  IBU  also 
increases  the  system  loss-of -control  reliability  because  it  can  survive  some  hardware  failures. 

Although  the  presence  of  an  IBU  has  a lot  of  advantages,  several  disadvantages  also  exist.  With  an 
IBU,  there  will  be  increased  system  complexity  which  will  result  in  increased  cost.  It  will  also  be  a 
source  of  additional  flight  control  system  failure  points.  The  existance  of  an  IBU  can  become  a 
design  "crutch"  and  be  overrelied  upon.  An  IBU  can  pose  problems  when  there  are  no  problems  in  the 
digital  system:  a nuisance  automatic  engagement  and  inadvertent  or  deliberate  pilot  engagements.  The 

IBU  may  also  require  additional  flight  testing  to  clear  its  flight  envelope.  It  might  also  mean 
additional  pilot  training  to  be  proficient  in  the  mode  (assuming  it  is  manually  switchable  from  the 
cockpit) . 

To  meet  design  requirements,  the  AFTI/F-16  program  utilized  a triplex  analog  IBU  design.  Since  the 
digital  flight  control  system  is  triplex,  an  analog  card  containing  an  IBU  was  located  in  each  digital  box. 
The  IBU  can  be  engaged  through  two  methods.  First  a switch  on  the  side-stick  allowing  the  pilot  to 
manually  either  engage  or  disengage  the  IBU.  This  gives  the  pilot  the  final  authority  to  judge  the  health 
of  the  digital  system.  The  second  method  of  IBU  engagement  is  by  the  digital  system  itself  when  it  can  no 
longer  identify  the  last  remaining  good  digital  processor.  In  this  case  the  IBU  will  automatically  be 
engaged. 

Early  in  the  overall  system  design  It  was  seen  as  beneficial  to  use  the  IBU  when  the  redundancy 
management  is  unable  to  a high  probability  identify  the  last  good  remaining  processor.  The  following 
scenario  illustrates  how  the  IBU  can  be  used  to  improve  the  overall  system  safety.  When  no  failure  exists, 
the  digital  system  uses  the  output  of  processor  B to  control  the  aircraft.  (Processors  A,  B,  and  C ate  all 
compared  to  ensure  B is  good).  If  one  processor  lias  failed,  the  remaining  two  good  processors  will  identify 
the  sick  processor  and  vote  it  off.  The  system  will  then  use  only  the  two  good  remaining  processors.  If 
a miscompare  then  occurs  between  the  two  remaining  processors,  they  both  go  into  self  test  with  the 
anticipation  that  one  will  self  test  "GOOD"  and  the  other  "BAD".  If  this  happens  the  aircraft  flys  home  on 
the  last  good  remaining  processor  (Figure  2).  If  both  should  test  "GOOD",  either  processor  could  be  chosen 
and  safe  operation  should  be  assured.  If  both  test  "BAD"  several  options  exist:  one  computet  could  be 
arbitrarily  chosen  (coin  flip)  to  fly  on,  or  the  computer  with  the  smallest  output  could  be  chosen  (a  small 

output  is  better  than  a hard  over  output).  In  any  case,  under  these  circumstances  there  is  no  guarantee  of 

correctly  choosing  the  last  good  remaining  processor.  On  the  AFTI/F-16  instead  of  arbitrarily  choosing  the 
last  processor  in  this  scenari  , the  system  will  automatically  revert  to  IBU  (Figure  3) . Without  an  IBU, 
the  redundancy  management  system  would  be  forced  to  choose  one  of  the  last  two  processors  to  fly  on. 

Some  small  risk  exists  that  the  incorrect  processor  would  be  chosen.  Yhe  level  of  this  risk  is  unknown 
since  there  are  no  known  failures  which  would  cause  botl  processors  to  self  test  "BAD".  This  Is  clearly 
a case  where  the  IBU  is  protecting  against  unknown  - unknowns.  Because  this  was  a new  flight  control 
concept  being  developed  and  flight  tested  (digital,  triplex,  asynchronous  design),  it  was  felt  to  be  more 
prudent  to  utilize  the  IBU.  It  should  be  noted  that  the  reliability  rate  for  loss-of-control  (less  than 
once  every  10?  flight  hours)  is  still  met  even  if  the  IBU  is  not  in  use  in  the  above  scenario. 

From  a control  law  standpoint,  it  was  decided  to  make  the  IBU  as  simple  as  possible  to  keep  the 
analog  real  estate  small  and  keep  the  IBU  as  independent  from  hardware  failures  as  possible.  Under  this 

criteria,  the  IBU  design  resulted  in  a system  with  three  input  paths  (pitch,  roll,  yaw)  and  a single 

feedback  path:  pitch  rate  feedback  which  was  the  minimum  necessary  co  maintain  aircraft  stability.  In 

the  roll  and  yaw  axis  no  feedback  was  used  even  though  the  dutch  roll  characteristics  were  rather  poor. 

The  design  resulted  in  a single  gain  system  wnich  had  to  have  sufficient  stability  margins  to  be  stable 
and  still  flyable  from  Mach  1.6  through  touchdown  speed.  The  critical  region  in  determining  the  value 
of  this  gain  was  the  low  altitude/ supersoni.  region.  This  resulted  in  forcing  the  gain  to  be  low  which 
caused  the  pitch  damping  at  power  approach  airspeed  to  be  low. 

Prior  to  first  flight  of  the  AFTI/F-16  the  IBU  (named  Original  IBU)  was  evaluated  in  a power  approach 
(PA)  configuration  on  the  NT-33A  Inflight  Simulator.  While  performing  a PA  task  this  IBU  was  given  Level  3 
flying  qualities  ratings  with  Cooper -Harper  ratings  of  8 to  9.5  in  pitch  and  4 to  5 in  roll.  The  level  3 
ratings  were  due  to  heavy,  sluggish  pitch  response,  a PIO  tendency  in  high  gain  tasks,  and  heavy  and 
extreme  gust  sensitivity  in  roll.  At  this  point  is  was  obvious  a single  gain  IBU  was  not  going  to  be 
sufficient  to  safely  fly  the  aircraft  throughout  the  entire  flight  envelope  and  still  safely  land  it. 
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As  an  interim  fix,  the  single  gain  system  was  adjusted  to  give  much  improved  low  speed  dynamics  but  had  to 
be  placarded  against  supersonic  flight  because  of  insufficient  stability  margins  (named  First  Flight  1BU) . 
(Figure  4).  This  IBU  doubled  the  forward  path  proportional  gain.  It  was  to  be  used  on  the  aircraft  until 
the  final  IBU  (named  Block  III  IBU)  could  be  built  and  incorporated  into  each  digital  processor  box.  The 
Block  III  IBU  was  a dual  gain  IBU  having  a low  gain  to  accommodate  the  supersonic  stability  tnargains  and 
upon  lowering  the  gear  handle,  a high  gain  for  landing.  Both  these  designs  were  then  tested  on  a second 
series  of  NT-33A  tests  and  both  found  to  have  good  level  2 handling  qualities. 

AUTOMATIC  IBU  ENGAGEMENT  SCENARIO 


IF  ONE  TESTS 
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Figure  2 Failure  Scenario 
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Figure  3 Result  of  Self  Test 
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Figure  4 IBU  Development  History 

As  first  flight  date  of  the  AFTI/F-16  approached,  a major  issue  began  to  surface  with  respect  to  the 
.ntional  inflight  usage  of  the  IBU.  Should  the  IBU  be  intentionally  engaged  inflight,  how  often,  and  in 
what  flight  conditions?  The  flight  test  commun-'ty  was  definitely  in  favor  of  testing  the  IBU  inflight  and 
desired  it  very  early  in  the  program  (second  or  third  flight).  The  advantages  of  doing  this  would  be  to 
gain  confidence  in  the  IBU  under  controlled  rather  tlian  last  chance  emergency  conditions.  Under  this 
scenario,  the  IBU  would  be  tested  under  benign  flight  conditions  and  there  would  be  a healthy  digital  flight 
control  system  to  immediately  revert  back  to  if  the  IBU  flying  qualities  showed  to  be  unsatisfactory.  Since 
the  NT-33A  evaluated  the  flying  qualities  to  be  very  close  to  Level  3,  this  did  not  seem  to  be  too  likely. 
From  a redundancy/reliability  standpoint  the  IBU  is  monitored  for  failure  at  all  times,  even  while  flying 
in  a digital  flight  control  mode.  The  IBU  on  the  AFTI/F-16,  being  a triplex  system,  is  fail-operative  after 
first  failure  but  has  no  protection  against  a second  failure.  The  IBU  hardware  has  a predicted  mission 
reliability  of  less  than  7X  10_6failure  per  flight  hour. 
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Several  reasons  also  exist  for  not  intentionally  turning  on  the  1BU.  The  IBU  is  an  emergency  mode 
and  was  deliberately  designed  to  be  "bare  bones  - get  home  and  land"  mode.  It  has  no  lateral  - directional 
feedbacks  nor  aileron  - rudder  interconnect  nor  yaw  damper;  thus  it  was  expected  to  have  poor  lateral  - 
directional  flying  qualities.  In  any  case,  the  flying  qualities  are  worse  than  the  normal  digital  modes. 
Also,  if  for  some  reason  the  system  would  not  reset  back  to  its  digital  normal  mode,  - real  emergency  would 
exist. 

Historical  data  has  not  shown  a very  good  track  record  concerning  inflight  engagements  of  flight  control 
system  backups.  Aircraft  such  as  the  B-47,  B-66,  Tornado,  and  Concorde  have  mechanical  backup  systems  for 
their  primary  flight  control  systems.  In  the  B-w7  and  B-66  these  mechanical  systems  were  maintenance 
nightmares  and  were  many  times  not  well  maintained.  In  the  B-66,  twice  pilots  switched  to  the  mechanical 
system  and  found  it  inoperative.  Neither  pilot  was  able  to  switch  back  to  the  hydraulic  (primary)  system 
which  resulted  in  less  of  both  aircraft. 

Those  in  favor  of  engagement  of  the  IBU  inflight  won  and  the  IBU  was  first  engaged  during  the  third 
flight  of  the  aircraft.  All  the  pilots  commented  that  the  IBU  had  degraded  flying  qualities  as  compared 
to  the  Standard  Normal  Node  but  that  the  flying  qualities  were  sufficient  as  a backup  mode.  Pitch  axis 
was  very  stable  but  possessed  moderate  to  heavy  stick  forces.  It  had  a lightly  damped  dutch  roll  which 
was  excited  by  roll  or  yaw  inputs.  The  IBU  to  date  has  been  flown  out  to  Mach  1.2.  At  that  speed  the 
pilot  got  into  a lateral  PIO  once  when  he  excited  the  dutch  roll  with  a maximum  rudder  input. 

The  IBU  is  now  routinely  engaged  during  the  course  of  flight  testing.  As  the  flight  envelope  is 
expanded,  the  IBU  is  now  one  of  the  first  modes  to  be  evaluated  at  each  new  flight  condition.  The  philo- 
sophy is  that  the  IBU  will  be  tested  for  safe  operations  to  give  confidence  in  case  of  non-resettafcle 
automatic  IBU  engagement. 

ISSUE:  CONTROL  LAM  AND  REDUNDANCY  MANAGEMENT  CO-EXISTING  IN  A DIGITAL  ENVIRONMENT 

A major  objective  of  the  AFTI/F-16  program  was  to  develop  and  evaluate  new  concepts  in  flight  control 
design.  One  of  the  major  concepts  being  developed  was  that  of  multimode  design  containing  task-tailored 
control  laws.  This  implies  a separate  flight  control  mode  be  designed  for  each  type  of  combat  task  to  be 
flown  (bombing,  air-to-air  gunnery,  etc.).  Also  required  with  this  control  law  structure  was  limited 
authority  six  degree-of -freedom  decoupled  set  of  flight  control  laws.  Additionally  required  was  separate 
reconfiguration  modes  which  allow  for  continued  flight  after  the  loss  of  flight  control  sensors  (pitch  rate, 
roll  rate,  tec.).  In  other  words,  a very  complex  set  of  control  laws  was  required  to  be  developed.  A 
second  major  concept  being  developed  was  a triplex,  digital  flight  control  computer  system.  This  system 
was  required  to  utilize  software  to  the  greatest  extent  possible  to  perform  all  control  law  and  all 
redundanev  management  functions.  Early  in  this  program,  some  important  decisions  were  made  concerning  the 
approach  used  to  implement  these  concepts.  At  the  time  these  decisions  were  made,  t was  felt  their  effect 
would  not  impact  each  other.  As  the  design  progressed  from  development  to  mechanization  to  flight  testing, 
it  became  obvious  these  decisions  were  greatly  intertwined  and  system  adjustments  were  necessary  to  allow 
for  harmonious  system  operation.  One  of  these  decisions  was  to  operate  the  digital  computers  asynchronously 
with  respect  tc  time.  The  other  decision  was  to  deoign  the  control  laws  utilising  Linear  Quadratic 
Synthesis  (LQS) . 

Asynchronous  digital  computer  operation  implies  that  the  individual  clocks  in  each  processor  will 
operate  independent  of  each  other  thus  implying  the  time  skew  between  each  proceosor  will  not  be  controlled 
(Figure  5).  Therefore  each  processor  will  receive  its  input  data  at  different  times  and  will  complete  the 
output  surface  computations  at  different  times.  Prior  to  making  the  decision  to  go  asynchronous,  a trade 
study  was  performed.  Some  of  the  mam  conclusions  of  this  study  were: 

Synchronous  Operation 

Advantages: 

1.  Simpler  Operational  Flight  Program  (OFP)  verification  and  testing. 

2.  Cross-channel  monitor  trip  level  at  output  selector/monitor  plane  can  te  set  to  a near  zero  value 
(a  cross-channel  difference  can  be  used  as  a failure  indication). 

Disadvantages: 

1.  Sync  function  must  be  carefully  designed  so  as  not  to  introduce  a single  point  failure  possibility 
into  the  system. 

2.  Design  is  not  inherently  fault-tolerant.  Unless  special  care  is  taken,  a transient  condition  in 
one  branch  will  in  general  result  in  a branch  being  temporarily  disconnected. 

Asynchronous  Operation 

Advantages: 

1.  More  fault-tolerant  since  branches  are  not  expected  to  be  in  exact  agreement. 

2.  Insensitivity  to  short  term  electromagnetic  interference  effects  is  enhanced  since  data  which  is 
modified  or  in  error  is  likely  to  be  sensed  in  diverse  portions  of  the  redundancy  management  function. 

Disadvantages: 

1.  Increased  data  acquisition  speed  requirement  to  prevent  dynamic  responses  from  being  identified 
as  faults  at  the  output  selector/monitor  plane. 
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2.  Exact  skew  conditions  are  difficult  to  repeat  to  obtain  identical  results  during  testing. 

To  operate  the  computers  asynchronously  was  itself  a new  concept  never  before  tried  in  an  aircraft  flight 
control  system.  As  a result  of  the  trade  study,  it  was  decided  to  proceed  with  asynchronous  computer 
operation  even  though  this  was  obviously  riskier  than  taking  the  more  conventional  approach  of  synchronous 
operation. 
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Figure  5 Time  Skew 

An  equally  risky  approach  was  taken  in  using  the  LQS  approach  to  the  control  law  design.  The  control 
laws  were  developed  for  many  point  conditions  in  a batch  computer  mode  utilizing  a digital  computer  program 
called  DIGICON.  The  goal  in  the  control  law  design  was  to  have  a very  quick  responding  system,  both  in 
pitch  rate  and  onset  of  normal  acceleration,  and  this  system  would  provide  gust  alleviation  and  be  relatively 
invariant  to  uncertainties  in  the  airframe  aerodynamic  derivatives.  To  meet  these  design  goals,  a multi- 
state feedback  system  was  designed  which  had  very  high  gains  on  the  forward  path  signals,  especially  the 
error  signals  between  commanded  response  and  actual  aircraft  response.  The  result  of  these  high  gains  was 
a system  that  has  very  large  amplitude  and  high  frequency  content  in  the  output  signal  to  the  control 
surface  actuators. 

Within  the  digital  flight  control  system,  two  major  tasks  are  being  performed  during  each  frame:  the 

flight  control  law  computations  and  the  redundancy  management  computations.  Initial  development  of  these 
two  systems  (control  law  versus  redundancy  management)  was  done  separately;  it  was  not  until  later  in  the 
preflight  development  phase  of  the  program  that  the  two  systems  ;ere  integrated  together. 

The  redundancy  management  system  is  an  integral  part  of  any  multiple  computer  system.  The  purpose  of 
the  redundancy  management  system  is  to  ensure  that  the  aircraft  is  always  being  flown  by  a healthy 
processor  (s).  One  component  of  this  system  which  highly  interacts  with  the  control  laws  is  the  output 
selector/monitor  (S/M) . The  function  of  the  output  S/M  is  to  compare  the  surface  commands  of  all  three 
processors  to  detect  computational  failures.  Each  processor  has  its  own  output  S/M  which  compares  all 
eight  of  its  surface  command  outputs  with  those  of  the  other  two  processors.  If  any  processor’s  output 
(including  itself)  differs  by  more  than  a given  percentage  from  the  other  processors,  that  computer  output 
from  that  processor  is  identified  as  having  possibly  failed.  If  this  condition  persists  for  seven 
computational  frames,  that  output  from  that  processor  is  voted  off-line.  This  given  percentage  is  called 
the  trip  level  and  its  purpose  is  to  prevent  a sick  output  of  any  processor  from  commanding  an  aircraft 
surface.  In  order  to  have  early  warning  of  a possible  failure  and  prevent  any  aircraft  failure  transients, 
ideally  this  trip  level  would  be  set  near  zero  percent  difference.  But  this  is  impossible  because  of 
asynchronous  nature  of  the  system.  This  asynchronism  will  allow  each  processor  to  be  time  skewed  from  each 
other  processor  - each  processor's  output  being  different  even  for  a perfectly  healthy  system  (Figure  6). 

The  difficulty  arises  in  determining  an  acceptable  trip  level  which  allows  normal  operation  to  continue 
in  a time  skewed  environment  and  still  identify  output  failures  at  a safe  level.  For  a healthy  system, 
three  factors  will  affect  the  inter-channel  difference  between  the  outputs  from  the  three  processors:  the 

time  skew  between  the  three  processors,  the  change  of  the  input  signals  (both  commands  and  sensor  inputs)  in 
that  time,  and  the  control  law  gains  and  structure  which  amplify  these  differences.  As  stated  above  the 
desired  size  of  this  trip  level  is  controlled  by  two  opposing  factors.  The  trip  level  must  be  large  enough  to 
allow  for  a normal  interchannel  difference  due  to  the  three  factors  listed  above  so  it  will  not  erroneously 
declare  an  output  failure.  Opposing  this,  the  trip  level  must  be  small  enough  such  that  a real  failure  can  be 
identified  before  it  can  produce  a large  (unsafe)  aircraft  transient  when  switching  from  a sick  output  to  a 
healthy  output.  Although  this  non-zero  trip  level  allows  the  system  to  be  fault  tolerant  (it  could  possibly 
allow  a small  short  term  transient  to  pass  through  system  without  declaring  a failure),  a deficiency  of  this 
asynchronous  system  is  its  inability  to  always  distinguish  the  difference  between  a time  skewed  output  mis- 
compare  and  an  actual  failed  output  at  a low  threshold  level. 

When  the  total  system  was  integrated  initially  the  inability  of  the  redundancy  management  system  and 
the  control  laws  to  work  in  perfect  harmony  became  obvious.  Originally  the  output  trip  level  was  set  at  a 
constant  value  of  15%  of  full  scale  deflection  of  each  given  surface.  When  the  total  system  was  first 
tested  on  the  simulator,  it  was  found  that  large  inputs,  especially  at  moderate  to  high  frequency,  were 
exceeding  this  15%  trip  level  in  the  output  S/M.  At  this  point  comparisons  were  made  between  the  AFTI/F-16 
control  laws  and  those  in  the  F-16.  It  was  found  in  some  cases  that  the  gains  in  the  AFTI/F-16  control  laws 
were  sometimes  many  times  larger  than  equivalent  gains  in  the  F-16.  Some  suggested  the  AFTI/F-16  gains  were 
unrealistically  high.  In  any  case  these  high  gains  generated  by  the  LQS  approach  proved  to  be  a real 
deficiency  of  that  type  of  control  law  design. 
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Figure  6 System  Interaction 

The  LQS  design  methodology  used  on  the  AFTI/F-16  varied  the  gains  in  the  forward  path  and  feedback  paths 
to  satisfy  a Cost  function  and  performance  criteria.  Unfortunately  the  method  did  not  give  the  designer  a 
sensitivity  analysis  of  the  effect  of  the  gain  on  system  performance.  The  end  effect  was  the  final  design 
resulted  in  some  very  large  gains  which  could  have  been  reduced  at  a very  small  loss  of  performance.  These 
large  gains  caused  a lot  of  problems  when  integrates  with  entire  system.  They  would  produce  a large  amount 
of  control  surface  activity  which  meant  hinge  moment  limits  were  a bigger  problem,  more  surface  rate  limiting, 
and  large  demands  on  the  hydraulic  system.  The  end  result  with  respect  to  the  redundancy  management  was  that 
for  maximum  processor  skews,  a very  small  difference  in  input  signal  magnitude  could  result  in  very  large 
differences  at  the  output  plane  for  non-failed  conditions.  Ultimately  the  gains  had  to  be  reduced  to  be 
more  realistic  and  to  coexist  with  the  redundancy  management.  The  lowering  of  the  gains  was  not  done  with- 
out some  penality;  in  some  cases  it  resulted  in  reduced  robustness  of  the  aircraft  response  and  possible 
degradation  of  aircraft  handling  qualities.  The  primary  area  this  gain  reduction  occurred  was  the  forward 
path  to  the  elevator  in  all  the  flight  control  modes  and  the  forward  path  to  the  trailing  edge  flaps  in  the 
decoupled  control  modes.  The  region  of  the  flight  envelope  most  affected  by  the  gain  reduction  was  the  high 
altitude,  low  dynamic  pressure  areas.  In  this  region,  the  sluggish  performance  of  the  basic  airframe  is 
masked  by  the  very  high  gain  control  laws  to  achieve  good  tracking  performance  and  improved  handling 
qualities;  therefore,  the  gain  reduction  had  its  greatest  effect  there.  In  general  though,  gains  were 
.educed  throughout  the  flight  envelope.  The  effect  of  reducing  the  gains  in  the  forward  path  to  the 
elevator  was  a reduction  of  system  bandwidth  in  the  pitch  response.  The  effect  of  reducing  the  gains  in 
the  forward  path  to  the  elevator  was  a reduction  of  system  bandwidth  in  the  pitch  response.  The  effect  of 
reducing  the  gains  in  the  forward  path  to  the  trailing  edge  flaps  was  an  increase  in  the  impurity  present 
in  the  decoupled  control  options.  The  end  result  was  the  control  laws  had  to  be  changed  from  their 
optimal  design  to  live  in  harmony  with  the  redundancy  management  system. 

The  redundancy  management  system  was  also  changed  to  be  more  compatible  with  the  control  laws.  The 
constant  15%  trip  level  was  changed  to  be  a variable  trip  level  based  on  the  rate  of  change  of  a specific 
output  in  its  own  processor.  In  most  cases  the  trip  level  is  15%  but  it  can  reach  as  high  as  30%.  This 
change  still  provides  the  same  level  of  protection  against  a real  failure.  If  one  processor  has  a failure 
forcing  one  of  its  outputs  to  increase  ac  a high  rate  (thus  increasing  its  trip  level  to  30%)  the  other  two 
processors  may  still  be  using  15%  for  that  output,  thus  voting  it  as  failed  as  early  as  if  all  three 
processors  were  using  15%.  Other  changes  also  made  to  the  redundancy  management  system  because  of  the  high 
gain  control  laws  were  to  increase  the  rate  at  which  some  inputs  are  sampled  and  to  increase  the  update  rate 
of  gain  tables.  These  changes  were  necessary  to  prevent  large,  rapid  spikes  to  propagate  to  the  output  S/M 
plane.  Therefore,  the  end  result  was  the  redundancy  management  system  also  had  to  be  modified  to  live  in 
harmony  with  the  control  laws.  Tnis  system  adjustment,  to  make  the  control  laws  and  redundancy  management 
system  work  in  harmony,  was  primarily  performed  on  the  simulator.  During  the  flight  testing  phase 
(a  total  of  118  flights,  j.77  flight  hours)  only  one  inflight  flight  control  system  fault  indication  occurr  d 
which  resulted  in  a control  law  gain  adjustment. 

As  a result  of  the  flight  test  program,  several  conclusions  can  be  made  concerning  the  operation  of 
high  gain  control  laws  in  an  asynchronous  computer  environment.  First  (and  most  important),  these  two 
systems  can  be  made  to  work  together  successfully.  During  the  last  two  weeks  of  flight  testing,  the 
pilot  was  permitted  to  aggressively  fly  air-to-air  and  air-to-ground  combat  scenarios  and  the  system 
performed  flawlessly  with  zero  flight  control  problems.  The  second  conclusion  is  chat  there  is  an  inter- 
dependency between  the  control  laws  and  the  redundancy  management  in  an  asynchronous  computer  system,  and 
the  two  parts  cannot  be  developed  independent  of  one  another.  The  smaller  the  control  laws  gains  are  or 
the  faster  the  computer  frame  rate  is,  the  less  this  will  be  a problem.  On  the  AFTI/F-16,  the  computer 
processors  have  a frame  length  of  approximately  16  milliseconds  which  allows  the  worst  case  skewing 


between  any  two  of  the  tnree  processors  to  be  about  C milliseconds.  For  this  system,  there  obviously  was 
a limit  to  how  large  the  control  law  gains  cou1d  be  and  still  coexist  with  the  redundancy  management  system 
With  these  gain  restrictions,  the  control  laws  on  the  AFTI/F-16  were  still  sufficiently  robust  that  they 
received  Level  1 Cooper -Harper  Handling  Qualities  Ratings  in  all  the  combat  modes.  These  control  laws 
were  also  determined  to  have  improved  handling  qualities  over  the  basic  F-16  in  all  combat  modes  and  in 
power  approach  and  landing.  Third,  this  asynchronous  design  proved  to  be  very  fault  tolerant.  During 
the  flight  testing  phase,  forty-one  inflight  flight  control  system  fault  indications  occurred.  The  effect 
of  these  fault  indications  ranged  from  no  loss  of  the  system  redundancy  up  to  the  loss  of  two  channels  of 
redundancy  (i.e.,  flying  on  only  one  processor).  In  almost  all  these  cases  the  system  was  resettable  to  a 
zero  fault  condition.  In  no  case  was  there  a degradation  or  change  in  the  aircraft  handling  qualities 
due  to  a fault  indication. 

ISSUE:  PECOUPLEL  CONTROL  LAWS 

The  AFTI/F-16  digital  flight  control  system  contains  eight  primary  task-tailored  control  law  modes 
(Figure  7).  These  modes  are  full  authority  and  are  optimized  for  specific  tasks  such  as  air-to-air  gunnery 
and  air-to-surface  bombing.  For  verrier,  fine  tracking  adjustments,  six  decoupled  control  options  were 
developed.  These  options  include:  in  the  longitudinal  axis  - pitch  pointing,  direct  lift,  and  vertical 

translation  (Figure  8);  in  the  lateral  - directional  axis  - yaw  pointing,  direct  side  force  (alsc  named 
wings  level  turn  or  flat  turn),  end  lateral  translation  (Figure  9).  (See  Reference  1 for  a description  of 
these  modes).  These  decoupled  control  options  are  superimposed  on  the  primary  control  laws  as  a secondary 
means  of  precisely  tracking  a target  in  the  final  stages  of  a tracking  solution. 

AFTI/F-16  Multimode  Flight  Controller  Commands 
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Figure  7 AFTI/F-16  Flight  Control  Modes 


• PITCH  ATTITUDE  CONTROL  AT 

CONSTANT  FLIGHT  PATH  ANGLE 

^ 

Q ^ 

VT" 

f ' 

• DIRECTIONAL  ATTITUDE  CONTROL  AT 
CONSTANT  FLIGHT  PATH  ANGLE 


Figure  8 Longitudinal  Decoupled  Options 


Figure  9 Lat-Dir  Decoupled  Options 
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During  the  Fighter  CCV  program  (utilizing  a YF-16  as  a testbed)  all  six  of  the  decoupled  modes  were 
evaluated  inflight.  On  that  aircraft,  the  decoupled  control  responses  were  generated  in  an  auxiliary 
flight  control  computer  which  was  not  an  integral  part  of  the  primary  analog  quad  redundant  flight  control 
system.  This  was  to  allow  the  aircraft  to  always,  instantly  revert  back  to  its  primary  coupled  control 
laws  if  the  aircraft  got  into  a problem  area  during  the  decoupled  operation.  Since  the  baseline  YF-16 
feedback  remained  intact  within  the  primary  computer,  specific  feedbacks  not  desired  for  decoupled  operation 
were  cancelled  by  predicted  open  loop  response  signals  from  the  auxiliary  computer.  Gain  scheduling  as  a 
function  of  air  data  parameters  provided  operation  of  the  decoupled  options  over  a wide  range  of  flight 
conditions. 

In  the  AFTI/F-16  flibht  control  system,  the  entire  control  law  architecture  was  redesigned  from  the 
existingF-16  control  laws.  There  was  no  requirement  (nor  need)  to  jury-rig  the  decoupled  control  system  to 
an  existing  full  authority  control  system  as  was  cone  in  the  Fighter  CCV  program.  Therefore  two  methods 
existed  for  integrating  the  limited  authority  decoupled  control  laws  with  the  full  authority  system.  The 
first  method  was  the  open  loop  approach  similar  to  the  Fighter  CCV;  the  second  method  was  the  closed  loop 
approach  integrating  the  decoupled  control  laws  with  the  entire  control  law  structure  and  utilizing  the 
multiple  sensor  feedbacks  that  were  available.  Being  an  advanced  development  program  evaluating  new  aspects 
of  integrated  flight  control  technology,  the  latter  approach  was  chosen. 

In  the  AFTI/F-16  program,  the  first  major  decision  to  be  made  with  respect  to  decoupled  control  was 
what  type  of  controllers  would  be  used  to  input  decoupled  commands.  On  the  Fighter  CCV,  a miniature  two- 
axjs  force  controller  was  installed  on  top  of  the  YF-16  side  stick  controller  for  commanding  the  decoupled 
modes.  As  a pilot  option,  the  rudder  pedals  could  be  used  to  input  lateral -directional  modes.  The  pilots 
found  that  this  two-axis  controller  produced  a lot  of  crosstalk  with  the  coupled  controller  anytime  a de- 
coupled input  was  made.  In  other  words,  it  was  difficult  to  make  a decoupled  input  without  unintentionally 
deflecting  the  coupled  (primary)  side  stick  controller.  The  AFTI/F-16  chose  to  use  separate  controllers 
(not  co-located)  to  command  decoupled  inputs.  This  was  to  prevent  cross-talk  or  interference  between 
controllers.  Only  two  controllers  were  necessary  to  make  all  decoupled  inputs.  The  pilot  controller  chosen 
for  lateral-directional  inputs  was  the  rudder  pedals.  Flight  testing  showed  the  rudder  pedals  to  be  very 
natural  for  this  task.  For  the  longitudinal  inputs,  the  throttle  grip  was  modified  to  have  a dual  function 
as  a throttle  and  as  a decoupled  motion  controller.  As  a controller  the  throttle  is  twisted  aft  to  command 
up  motion  and  twisted  forward  to  command  down  motion  (Figure  10).  Flight  testing  showed  the  twist  throttle 
to  have  several  problems.  The  pilot  tended  to  put  inadvertent  twist  throttle  inputs  in  during  high  gain 
tracking  tasks  and  high  G-loading.  If  the  twist  throttle  was  held  slightly  out  of  detent,  the  trailing 
edge  flaps  would  integrate  to  their  limits,  hence  greatly  increasing  drag.  Sometimes  the  pilot’s  first 
indication  of  an  inadvertant  input  was  the  slowing  of  the  aircraft  or  the  onset  of  wing  buffet.  The  second 
problem  is  the  twist  grip's  harmony  with  the  side  stick  controller.  The  pilots  found  it  difficult  to  use 
the  twist  throttle  and  the  pitch  stick  simultaneously  to  control  the  pitch  axis.  To  use  the  throttle,  the 
pilot  generally  had  to  freeze  the  pitch  stick  which  tended  to  increase  pilots  overall  workload. 


Figure  10  Throttle  Twist  Grip 

The  utility  of  the  decoupled  control  options  is  very  dependent  on  their  response  being  linear,  predict- 
able, free  of  large  impurities,  relatively  quick,  and  of  sufficient  magnitude  to  be  useful.  It  is  not 
necessary  for  these  control  laws  to  be  able  to  perform  gross  acquisition  tasks,  but  they  must  be  very 
effective  at  vernier  tracking  tasks  to  be  useful.  Results  from  the  Fighter  CCV  program  showed  the  highest 
payoff  for  these  modes  to  be:  pitch  and  yaw  pointing  for  gunnery  tasks;  direct  side  force  for  air-to-air 

tracking,  strafing  and  bombing;  direct  lift  for  defensive  maneuvering  to  confuse  an  attacker;  and  lateral 
translation  for  strafing  or  landing  in  a crosswind.  Vertical  translation  showed  very  little  utility  for 
any  task. 

Below  is  a summary  of  results  from  flight  testing  the  decoupled  control  options  on  the  AFTI/F-16. 

This  summary  includes  what  each  controller  commanded,  authority  levels  used  by  the  pilots,  and  the  option's 
primary  utility. 

• For  flat  turn,  -he  rudder  pedal  commands  an  acceleration.  The  average  maximum  authority  used  by  the 
pilots  was  0.5  G's  (Figure  11).  Of  the  six  modes  evaluated,  this  mode  was  found  to  be  the  most  useful  for 
reducing  the  time  to  a firing  solution  on  a combat  target.  Flat  turn  was  found  ideal  in  air-to-surface 
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bombing  and  strafing  to  null  small  tracking  errors  on  the  target.  Approximately  3 degrees  (50  milli- 
radlans)  w.  s the  changeover  point  where  conventional  turning  was  quicker  than  flat  turn.  The  pilots 
found  flat  turn  was  especially  optimum  in  eliminating  10  milliradian  errois;  for  removing  large  track- 
ing errors  the  lateral  accelerations  produced  by  the  flat  turn  (0.7  to  1.0  G's  side  force)  was  objection- 
able to  the  pilots.  For  these  large  errors,  the  pilots  found  conventional  banking  was  best  for  the 
acquisition  task  and  flat  turn  best  for  removing  the  final  tracking  error. 

• For  direct  lift,  the  twist  throttle  commands  an  acceleration.  The  average  maximum  authority  used 
by  the  pilots  was  0.7  G's.  Although  the  response  to  the  twist  throttle  input  was  smooth,  linear,  and 
predictable,  direct  lift  did  not  show  great  utility  since  the  pitch  stick  also  provided  precise  flight 
path  control  for  air-to-ground  tasks. 

• For  pitch  and  yaw  pointing,  the  twist  throttle  and  rudder  pedal  command  an  angular  rate.  The 
average  maximum  authority  used  for  pitch  pointing  was  3.0  degrees;  yaw  pointing  was  3.5  degrees.  The 
pointing  modes  were  initially  programmed  to  be  used  in  air-to-air  combat  and  strafing.  But  after  some 
initial  flight  testing,  the  pilots  discovered  they  preferred  controlling  flight  path  (flat  turn,  direct 
lift)  rather  than  weapon  line  pointing  for  the  strafing  task.  Pitch  pointing  was  found  useful  in  track- 
ing a cooperative  air-to-air  target  aircraft,  but  for  a jinking  target,  pitch  pointing's  utility  greatly 
diminished  because  of  its  limited  authority  and  speed.  As  with  direct  lift,  the  pitch  stick  could  crack 
as  well  as  pitch  pointing  thereby  further  diminishing  its  need.  Yaw  pointing’s  utility  was  slightly  better, 
but  it  was  only  good  for  small  lateral  corrections.  When  maximum  pointing  angles  were  commanded,  roll 
coupling  was  sometimes  a problem.  All  the  pilots  commented  they  would  have  preferred  commanding  pointing 
angle  rather  than  pointing  rate  for  both  pointing  modes. 

• For  vertical  and  lateral  translation,  the  twist  throttle  and  rudder  pedal  commands  an  acceleration. 
In  close  formation  flying  the  pilots  felt  these  modes  actually  increased  their  workload  over  conventional 
techniques.  This  was  possibly  due  to  these  modes  being  acceleration  command  systems  which  forced  the 
pilot  to  provide  lead  compensation  to  precisely  position  the  aircraft.  All  the  pilots  stated  the  modes 
would  have  had  more  utility  if  they  were  velocity  command  systems. 
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Figure  11  Flat  Turn  Time  History 


Purity  of  the  decoupled  responses  became  an  issue  as  the  mode  designs  began  to  finalize.  With  the 
open  loop  system  used  on  the  Fighter  CCV,  the  purity  level  was  a function  of  how  accurately  tne  designer 
could  predict  the  aerodynamic  forces  produced  by  each  control  surface.  In  the  closed  loop  system,  tne 
designer's  ability  to  feedback  the  correct  variables  will  provide  the  primary  influence  on  mode  purity. 

As  an  example,  in  the  direct  side  force  mode  the  rudder  pedal  input  is  a lateral  acceleration  command.  The 
lateral  acceleration  error  passes  a proportional  plus  integral  network  then  commands  a canard  surface 
deflection.  To  maintain  zero  sideslip  angle,  sideslip  rate  feedback  is  passed  through  a proportional  plus 
integral  network  then  commands  a rudder  surface  deflection.  The  difficulty  occurs  in  the  ability  to  accurately 
measure  (or  calculate)  sideslip  rate.  The  ideal  way  to  calculate  sideslip  rate  would  be  to  use  sideslip 
angle.  Unfortunately,  no  location  on  the  aircraft  could  be  found  from  which  a sideslip  angle  probe  worked 
accurately  at  all  flight  conditions.  As  a result,  sideslip  rate  was  calculated  by  using  yaw  rate,  lateral 
acceleration,  and  a small  roll  rate  component  to  compensate  for  any  angle-of -attack.  Without  there  being 
sideslip  angle  feedback,  any  steady  state  sideslip  that  exists  at  the  beginning  of  a direct  side  force 
maneuver  will  never  be  washed  out  during  the  maneuver.  Also  for  very  slow  command  inputs,  the  /aw  rate 
can  be  so  low  that  the  yaw  rate  sensor  is  ineffective  in  measuring  it,  thus,  sideslip  angular  error  will 
build  up. 


Flight  testing,  though,  showed  that  the  mode  purity  was  not  nearly  as  critical  as  originally  thought. 
There  appeared  to  be  a purity  threshold  above  which  further  improvement  had  no  effect  on  pilot  acceptability 
or  task  performance.  For  pitch  pointing  and  yaw  pointing  modes,  the  impurities  were  generally  proverse  in 
the  form  of  acceleration  in  the  direction  of  the  pointing  angle.  It  seemed  that  the  impurities  could  be 
fairly  large,  especially  air-to-air,  and  have  no  effect  on  pilot  performance.  During  strafing,  though, 
the  down  acceleration  impurity  associated  with  down  pitch  pointing  was  rather  objectionable.  For  vertical 
and  lateral  translation,  the  impurities  were  in  the  form  of  aircraft  rotation  and  the  amount  of  acceptable 
impurity  was  very  task  dependent.  If  the  task  was  formation  flying  or  aerial  refueling,  a little  impurity 
can  make  the  pilot  very  nervous.  Any  other  tasks  where  collision  avoidance  is  not  an  issue,  the  impurities 
were  not  important.  Proverse  rotational  impurity  was  less  disorienting  than  adverse.  For  direct  lift, 
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purity  did  not  appear  to  be  very  important.  For  flat  turn,  the  impurity  was  in  the  form  of  sideslip  angle. 
Proverse  sideslip,  because  it  is  in  the  direction  of  turn,  is  less  disconcerting  to  the  pilot  than  adverse 
sideslip.  Prom  a structural  standpoint,  proverse  sideslip  during  a flat  turn  can  generate  large  loads  on 
the  vertical  tail.  Therefore,  flat  turn  purity  may  be  primarily  dictated  by  structural  strength  rather 
than  pilot  performance. 

These  were  just  a few  of  the  problems  encountered  while  trying  to  integrate  decoupled/coupled  flight 
control  laws  into  one  system.  This  program  has  demonstrated  that  decoupled  control  laws,  especially  flat 
turn,  can  be  used  to  improve  weapon  system  effectiveness. 

CONCLUSIONS 

As  a result  of  these  design  issues,  several  conclusions  can  be  made: 

1.  An  IBU  is  effective  in  improving  user  confidence  while  flight  testing  a new  complex  digital  flight 
control  system.  An  IBU  also  provides  a safeguard  against  generic  software  failures. 

2.  An  asynchronous  computer  system  works;  the  redundancy  management  system  for  asynchronous  operation 
can  live  in  harmony  with  high  gain  control  laws  but  their  designs  will  be  interdependent  on  one  another. 

This  asynchronous  computer  system  (as  tested  on  the  AFTI/F-16) is  a highly  fault  tolerant  system. 

3.  Of  the  six  decoupled  control  law  options  tested,  flat  turn  is  the  most  effective  in  reducing  time- 
to  -lull  weapon  line  tracking  error  relative  to  conventional  tracking  methods.  The  rudder  pedals  are  ideal 
for  controlling  flat  turn  and  0.5  G's  is  its  optimum  authority  limit. 

EPILOGUE 

The  AFTI/F-16,  after  completion  of  all  system  modifications,  began  its  flight  test  phase  in  July  1982. 
The  flight  testing  was  successfully  completed  in  July  1983  at  which  time  Phase  I of  the  program  (Digital 
Flight  Control  System  Phase)  was  concluded  and  aircraft  modifications  for  Jhase  II  of  the  program 
(Automated  Maneuvering  Attack  System  Phase)  began.  In  this  second  phase  of  the  program,  the  aircraft  will 
be  tested  in  a much  harsher  environment  of  low  altitude,  automatic  weapon  delivery.  In  this  environment 
good  flight  control  system  reliability  and  high  pilot  confidence  in  the  system  is  essential  to  successfully 
achieve  program  goals.  The  ability  o the  aircraft  to  maneuver  precisely  and  aggressively  and  to  accurately 
deliver  weapons  in  a high-G  environment  is  also  an  important  factor  in  the  second  prase  of  this  program. 

To  allow  the  AFTI/F-16  program  to  reach  Its  goal  these  issues  and  many  others  had  to  be  (and  will  have  to  be) 
successfully  resolved. 
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